Brute Force Detection: Multiple Failures Followed by Success

Detects potential brute force attacks by identifying multiple failed logon attempts followed by a successful logon within a short period.

Microsoft Sentinel (KQL)